bump rails version for sec fix